30 lines
2.3 KiB
TypeScript
Executable File
30 lines
2.3 KiB
TypeScript
Executable File
import { IS_MAINNET, NETWORK, PROFILE } from '../shared/network.ts';
|
|
import { CHAIN_ID, GENESIS_HASH, GENESIS_TIME } from './testnet/consensus.ts';
|
|
|
|
export function launchManifest() {
|
|
return { profile: PROFILE, network: NETWORK, chainId: CHAIN_ID, genesis: GENESIS_HASH,
|
|
genesisTime: GENESIS_TIME, launchStatus: IS_MAINNET ? 'candidate-gated' : 'testnet', audited: false,
|
|
privatePeersSupported: true };
|
|
}
|
|
/** Operator risk acceptance is an accident-prevention gate, NOT evidence of external review. */
|
|
export function assertLaunchAllowed(env: NodeJS.ProcessEnv = process.env, now = Date.now()) {
|
|
if (!IS_MAINNET) return;
|
|
if (env.WIKIDECK_MAINNET_LAUNCH !== CHAIN_ID || env.WIKIDECK_MAINNET_RISK_ACK !== 'operator-accepts-unaudited-risk') {
|
|
throw new Error(`Mainnet candidate is launch-gated. Explicit chain approval and operator risk acceptance required: ${CHAIN_ID}`);
|
|
}
|
|
if (now < GENESIS_TIME * 1000) throw new Error('Mainnet candidate genesis time has not arrived; this is not an announced launch date');
|
|
const origin = new URL(env.PUBLIC_ORIGIN ?? 'http://invalid');
|
|
if (origin.protocol !== 'https:' || origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash) throw new Error('Mainnet requires an HTTPS PUBLIC_ORIGIN');
|
|
// Explicit operator-controlled cluster opt-in; never inferred from peer input.
|
|
// This permits private/HTTP RPC, not weaker browser HTTPS or chain/genesis gates.
|
|
const allowPrivate = env.WIKIDECK_ALLOW_PRIVATE_PEERS === '1';
|
|
const peers = (env.WIKIDECK_PEERS ?? '').split(',').map(s => s.trim()).filter(Boolean);
|
|
if (new Set(peers).size < 2) throw new Error('Mainnet launch requires at least two explicitly configured distinct peers');
|
|
for (const text of peers) {
|
|
if (!/^https?:\/\/[^/?#\\@\s]+\/?$/i.test(text)) throw new Error('Invalid mainnet peer origin');
|
|
const peer = new URL(text);
|
|
if ((peer.protocol !== 'https:' && !(allowPrivate && peer.protocol === 'http:')) || peer.origin === origin.origin || peer.username || peer.password || peer.pathname !== '/' || peer.search || peer.hash) throw new Error('Invalid mainnet peer origin');
|
|
}
|
|
if (new Set(peers.map(p => new URL(p).origin)).size < 2) throw new Error('Mainnet requires distinct peer origins');
|
|
}
|